MALICIOUS
186
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
This PDF file contains a large number of external links, many hosted on disposable domains, suggesting a link farm or phishing operation. The ClamAV detection and ML classifier strongly indicate malicious intent. While no scripts were directly extracted, the PDF structure and embedded URLs point towards a spearphishing attachment used to redirect users to malicious sites.
Machine Learning
- Nyx PDF Classifier malicious score 0.9992
Heuristics 6
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARMSmall PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://jumiwimov.ru/strik?utm_term=harga+efek+bass+boss+me-50b PDF link annotation
- https://cdn.sqhk.co/rapowipijes/yhdmepx/sowiwulenonuzenuwexinara.pdfIn PDF document text
- https://buparemekixa.weebly.com/uploads/1/3/0/7/130739227/349c6807.pdfIn PDF document text
- https://sivitudogadix.weebly.com/uploads/1/3/4/1/134108631/fogorezuxavurim.pdfIn PDF document text
- http://xuxikurov.mygamesonline.org/arthritis_back_exercises.pdfIn PDF document text
- https://donabetolemi.weebly.com/uploads/1/3/1/6/131637402/f36bdcd45da.pdfIn PDF document text
- http://waparudadip.mywebcommunity.org/maytag_bravos_washer_manual.pdfIn PDF document text
- https://cdn.sqhk.co/dojagomudek/bsJsggA/47254160023.pdfIn PDF document text
- http://lowufadit.scienceontheweb.net/altium_designer_18_tutorial.pdfIn PDF document text
- https://cdn.sqhk.co/savujegu/haGjege/dark_quest_2_nintendo_switch_review.pdfIn PDF document text
- https://cdn.sqhk.co/memenewo/eajjjbf/samsung_music_compatible_android_auto.pdfIn PDF document text
- https://wenabavur.weebly.com/uploads/1/3/1/3/131379405/3658738.pdfIn PDF document text
- https://cdn.sqhk.co/vezukefuza/oBSggQQ/amazon_driver_wage_california.pdfIn PDF document text
- http://mibejar.sportsontheweb.net/6144958783.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/f5a1616f-3d46-441e-91a2-6a0d5b7dc781/98201779243.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/2eb61eb4-431e-491d-b258-ae2eea3fdc95/69137079312.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/98ccbab3-d6cb-4c8d-888b-f24e0ef939a6/72377724420.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/dc9e776c-d08e-45d9-ad84-deb73ed32700/dd_3.5_underdark_races.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/d8e500bf-4bda-4219-8a60-f3e463ddf2f7/how_many_quarts_of_oil_does_a_lexus_es_350_take.pdfIn PDF document text
- http://posikin.myartsonline.com/biology_one_liner_in_english.pdfIn PDF document text
- http://rofuvawitarul.atwebpages.com/beatitudes_list.pdfIn PDF document text
- http://fumibilulad.atwebpages.com/the_righteous_mind_jonathan_haidt_download.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/4948085b-dbea-45ed-b189-b124e5e25993/10714239003.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/078cd2e0-135f-41e1-ae09-9df897c6f492/lilesasufigapifuko.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000e1db.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xE1DB | 5516 bytes |
SHA-256: 47a25bb50f1a410953818872c57ec9a3151a4ab0b7b020bc5bee99b368a3fe12 |
|||
font_01_sfnt_off0000f496.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xF496 | 12060 bytes |
SHA-256: 96c05ba32bb95a155f679baada9be5a4fb5897c6e1f95e6963562a02286fc2ae |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.